Forum Discussion

Aditya_Mehra's avatar
Aditya_Mehra
Icon for Cirrus rankCirrus
Nov 28, 2017

F5 sending TCP resets to Client during Client-F5 SSL Handshake

We have two clients trying to reach the same https URL which is a Virtual Server hosted on the F5 LTM.

 

Connection from one client to the destination server is complete through the F5.

 

However when the second client initiates a SSL communication to the LTM, the LTM responds with a TCP reset.

 

Cipher used is DEFAULT on the F5

 

When we took a SSL Dump we could see the below :

 

Working Client

 

C>SV3.3(241) Handshake

 

ClientHello

 

Version 3.3

 

S>CV3.1(74) Handshake

 

ServerHello

 

Version 3.1

 

Non - Working Client

 

C>SV3.3(267) Handshake

 

ClientHello

 

Version 3.3

 

S>C TCP RST

 

Need help to understand why one client is unable to connect when another connects on same F5 Virtual Server successfully.

 

application delivery
BIG-IP
LTM
security
ssl
  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Nov 28, 2017

    Aditya,

     

    What I can tell from the limited ssldump trace is both clients support tls1.2 (3.3) but the bigip downgrades to tls1.0 (3.1). I suspect the non working client doesn't support tls1.0.

     

    This could be the version of the browser being used perhaps?

     

    N